Merge branch 'main' into US302646_3P_Main

Author: DebLanger

exposure-management/TOC.yml

@@ -67,6 +67,9 @@
         - name: Review security initiatives
           href: initiatives.md
         - name: Investigate security metrics
+        - name: Security initiatives catalog
+          href: initiatives-list.md
+        - name: Investigate initiative metrics
           href: security-metrics.md
         - name: Review security recommendations
           href: security-recommendations.md

exposure-management/exposure-insights-overview.md

@@ -167,7 +167,4 @@ Events measure the score drop or worsening in the metric status. Events include:
 
 ## Next steps
 
-- [Review security initiatives](initiatives.md)
-- [Investigate security metrics](security-metrics.md)
-- [Review security recommendations](security-recommendations.md)
-- [Explore security events](security-events.md)
+- [Investigate security initiative metrics](security-metrics.md)

exposure-management/initiatives-list.md

@@ -0,0 +1,78 @@
+---
+title: Security initiatives in Microsoft Security Exposure Management
+description: Catalog of security Initiatives in Microsoft Security Exposure Management.
+ms.author: dlanger
+author: dlanger
+manager: rayne-wiselman
+ms.topic: reference
+ms.service: exposure-management
+ms.date: 11/12/2024
+---
+
+# Security Initiatives
+
+This is a catalog of security initiatives in Microsoft Security Exposure Management. Each initiative is designed to help you manage and improve the security posture of your organization.
+
+## Business Email Compromise - Financial fraud
+
+Business email compromise (BEC) financial fraud is a social engineering attack that aims to steal money or sensitive information. The attacker tricks the target into believing they're interacting with a trusted entity to conduct either personal or professional business. After deceiving the target, the attacker persuades them to share valuable information or process a payment.
+
+## CIS Microsoft 365 Foundations Benchmark
+
+The CIS Microsoft 365 Foundations Benchmark (v3.0.0) is a set of security assessments developed by the Center for Internet Security (CIS). It provides prescriptive guidance for establishing a secure baseline configuration for Microsoft 365. The benchmark includes configuration baselines and best practices for securely configuring a system. The benchmark is internationally recognized as a security standard for defending IT systems and data against cyber attacks. This initiative contains a subset of security assessments recommended by the CIS
+
+## Cloud Security [Preview]
+
+This initiative aims to reflect the status around cloud security coverage, ROI, health, configuration, and performance. It consists of measurements across multiple domains and disciplines to provide security managers with a high-level view into how posture is enforced in cloud ops.
+
+## Critical Asset Protection
+
+Critical asset protection refers to the strategies, processes, and technologies implemented to safeguard an organization's most valuable and important assets from various threats and risks. It involves identifying, prioritizing, and applying targeted security measures to ensure the resilience and integrity of these critical assets.
+
+[Learn more here.](https://aka.ms/xspm/cspm)
+
+## Endpoint Security
+
+Monitor the coverage and configuration of physical and virtual workstations, servers, and mobile phones.
+
+## Enterprise IoT Security
+
+IoT devices are often connected to endpoints, to one another or to the internet, which means they're potential targets for cyber attacks. It's imperative for businesses to monitor the security of their IoT devices, including their spread, configuration, connectivity, exposure, and behavior. This initiative provides overall visibility into the risk introduced by IoT devices in the enterprise and the resilience the organization has to mitigate it.
+
+## External Attack Surface Protection
+
+Microsoft Defender External Attack Surface Management (Defender EASM) continuously discovers and maps your digital attack surface to provide an external view of your online infrastructure. This visibility enables security and IT teams to identify unknowns, prioritize risk, eliminate threats, and extend vulnerability and exposure control beyond the firewall. Attack Surface Insights are generated by leveraging vulnerability and infrastructure data to showcase the key areas of concern for your organization. This initiative requires no license and is complementary.
+
+[Learn more here.](https://aka.ms/xspm/EasmLearnMore)
+
+## Identity Security
+
+Identity security is the practice of protecting the digital identities of individuals and organizations. This includes protecting passwords, usernames, and other credentials that can be used to access sensitive data or systems. Identity security is essential for protecting against a wide range of cyber threats, including phishing, malware, and data breaches. By taking proactive steps, organizations can help to protect their digital identities and sensitive data from cyber threats.
+
+## OT Security [Preview]
+
+Monitors and safeguards Operational Technology (OT) environments within the organization by employing network layer monitoring. This initiative identifies devices across physical sites, pinpoints their risks, and ensures comprehensive protection and security management of OT systems.
+
+## Ransomware Protection
+
+Ransomware attacks have become increasingly common in recent years, and they can have a devastating impact on organizations. Organizations can and should be proactive in managing a good security posture against ransomware. One of the first steps is to ensure that recommended controls are in place and are utilized and configured properly, hence reducing the risk of a successful ransomware attack making way into corporate networks and assets.
+
+## SaaS Security
+
+This initiative focuses on displaying the current state of SaaS (software as a service) security coverage, health, configuration, and performance. It consists of metrics across multiple domains and disciplines to provide security managers with a high-level view into their SaaS security posture management. To make the most of this Initiative, activate application connectors for the following: Microsoft 365, Salesforce, ServiceNow, GitHub, Okta, Citrix ShareFile, DocuSign, Dropbox, Google Workspace, NetDocuments, Workplace (preview), Zendesk, Zoom (preview), Atlassian. Learn more on connectors enablement: [https://aka.ms/AAs4lmg](https://aka.ms/AAs4lmg)
+
+[Learn more here.](/defender-cloud-apps/saas-security-initiative)
+
+## Vulnerability Assessment
+
+This initiative serves as a central hub for security managers to continuously assess and analyze vulnerabilities and misconfigurations across the organization's digital landscape. In the Vulnerability Assessment initiative users can actively identify, prioritize, track, and delegate vulnerabilities with in the IT infrastructure and the cloud. Users gain real-time visibility into the security posture of their organization, enabling data-driven decision-making for resource investment and placement. This collaborative environment ensures a holistic approach to vulnerability management, empowering stakeholders to proactively strengthen their security defenses, reduce the attack surface, and enhance overall resilience against evolving cyber threats.
+
+## Zero Trust (Foundational)
+
+Zero Trust is a security strategy that follows three principles, verify explicitly, use least privilege access, and assume breach. This initiative follows Microsoft's Zero Trust adoption framework to help you identify next steps in your Zero Trust strategy. You can learn more about the Zero Trust adoption framework here.
+
+[Learn more here.](https://aka.ms/xspm/zeroTrustLearnMore)
+
+## Next steps
+
+- [Investigate security initiative metrics](security-metrics.md)

exposure-management/media/choke-points on map.png

@@ -9,9 +9,9 @@ ms.service: exposure-management
 ms.date: 11/13/2024
 ---
 
-# Investigate security metrics
+# Investigate security initiative metrics
 
-Security metrics in [Microsoft Security Exposure Management](microsoft-security-exposure-management.md) measure security exposure for a specific scope of assets or resources within a [security initiative](exposure-insights-overview.md). Most security initiatives (but not all) have metrics associated with them.
+Security initiative metrics in [Microsoft Security Exposure Management](microsoft-security-exposure-management.md) measure security exposure for a specific scope of assets or resources within a [security initiative](exposure-insights-overview.md). Most security initiatives (but not all) have metrics associated with them.
 
 ## Prerequisites
 
@@ -27,7 +27,7 @@ Security metrics in [Microsoft Security Exposure Management](microsoft-security-
 
 ## Review security metrics
 
-1. In the [Microsoft Defender portal](https://security.microsoft.com), select **Exposure management -> Exposure insights ->Metrics** to open the [Metrics](https://security.microsoft.com/exposure-metrics) page.
+1. In the [Microsoft Defender portal](https://security.microsoft.com), select **Exposure management -> Exposure insights -> Metrics** to open the [Metrics](https://security.microsoft.com/exposure-metrics) page.
 
     :::image type="content" source="./media/metrics.png" alt-text="Screenshot of the metrics page in Microsoft Security Exposure management.":::
 

exposure-management/security-metrics.md

@@ -39,6 +39,12 @@ The Device Inventory and Attack Surface Map now display the data sources for eac
 
 For more information on understanding data from external sources, see [Getting value from your data connectors](value-data-connectors.md)
 
+### OT security initiative
+
+The new Operational Technology (OT) security initiative equips practitioners with a powerful tool to identify, monitor, and mitigate risks across the OT environment, ensuring both operational reliability and safety. This initiative aims to identify devices across physical sites, assess their associated risks, and provide faster, more effective protection for OT systems.
+
+For more information, see, [Review security initiatives](initiatives.md)
+
 ### Microsoft Security Exposure Management is now supported in Microsoft Defender XDR Unified role-based access control (RBAC)
 
 Access control to Microsoft Security Exposure Management can now be managed using Microsoft Defender XDR Unified Role-Based Access Control (RBAC) permissions model with dedicated and granular permissions.